Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35943

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35943

CVE-2020-35943 affects the WordPress NextGEN Gallery plugin prior to version 3.5.0. A CSRF weakness in the plugin’s request handling (notably in security checks around nonce validation) could allow an attacker to upload arbitrary files via crafted requests, with potential for remote code executio...

CVE-2020-35943

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35942

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35942

The CVE concerns WordPress NextGEN Gallery plugin prior to version 3.5.0. A CSRF logic flaw in is_authorized_request (and related checks) could permit requests without a proper nonce, enabling actions via settings modification that allow file upload and local file inclusion, which could lead to r...

CVE-2020-35942

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

PT-2021-11874

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery plugin versions prior to 3.5.0 Description: A Cross-Site Request Forgery CSRF issue allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF...

PT-2021-11875

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery plugin versions prior to 3.5.0 Description: A Cross-Site Request Forgery CSRF issue allows File Upload by bypassing CSRF protection, which can be achieved by not including a nonce parameter. Recommendations: For versions prior...

CVE-2020-35943: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35942: Improper Neutralization of Input During Web Page Generation

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

WordPress NextGEN Gallery plugin 跨站请求伪造漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...

WordPress NextGEN Gallery plugin 跨站请求伪造漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...

Critical WordPress Plugin Flaw Allows Site Takeover

Researchers are urging WordPress websites that utilize the NextGen Gallery plugin to apply a patch addressing critical and high-severity flaws. The NextGen Gallery plugin, which is installed on 800,000 WordPress websites, allows sites to upload photos in batch quantities, import metadata and edit...

NextGen Gallery < 3.5.0 - CSRF allows File Upload

It was possible to bypass the "validateajaxrequest" function used to control access to ajax functions by sending a request without a nonce parameter. This could be used to upload arbitrary code to an image file. Although the uploaded file must be a valid image, it is possible to include PHP code ...

NextGen Gallery < 3.5.0 - CSRF allows File Upload, Stored XSS, and RCE

It was possible to bypass the "isauthorizedrequest" function used to control access to plugin settings by sending a request without a nonce parameter. This could be used to upload arbitrary code to a CSS file with a double extension e.g. file.php.css, and could also be used to include the uploade...

WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI

Cross-Site Request Forgery CSRF leading to XSS and RCE via file upload and LFI found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...

WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to file upload

Cross-Site Request Forgery CSRF vulnerability leading to file upload found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...

WordPress NextGEN Gallery Plugin Cross-Site Scripting (CVE-2010-1186)

A script injection vulnerability exists in Alex rabe nextgen gallery 0.33. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...